ASIC Confirms on Cybersecurity Controls by AFS Licensees

Thursday, 12/05/2022 | 07:04 GMT by Arnab Shome
  • The confirmation came after a court ruling against an AFS license holder.
  • There is no specific cybersecurity measure on AFS license obligations.
australia, best forex brokers

Under the many conditions of an Australia Financial Services (AFS) license, the specific requirements of cybersecurity measures are not mentioned. But, a federal court in the country held an AFS license holder accountable for breaches of its license obligations for failing to adequately manage its cybersecurity risks.

Now, the Australian Securities & Investments Commission (ASIC) has clarified its stance on adequate cybersecurity measures for regulated financial market players. ASIC issues the AFS license and conducts supervisory duties.

“ASIC does not prescribe technical standards nor provide expert guidance on operational aspects of cybersecurity. We also do not prescribe specific requirements for individual license holders,” the regulator stated.

“We do, however, expect licensees to address cyber risk as part of their AFS license obligations, including risk management.”

In addition, it clarified that dual-regulated AFS licensees have the obligation to comply with all necessary standards of the other regulator.

Cybersecurity Measures Are Needed

The questions of cybersecurity measures as a part of the AFS license obligation arose with a ruling against RI Advice by an Australian court. The company was found to have breached its license obligations as it failed to have adequate risk management systems to manage its cybersecurity risks.

The judge acknowledged that it is not possible to reduce the risks of any cyber attack to zero. But, the companies can significantly reduce the risks by implementing appropriate measures.

The Australian Cyber Security Centre (ACSC) already recommended companies implement at least eight essential mitigation strategies to reduce cybersecurity risks, but they are not obligatory.

“This decision confirms that AFS licensees must have adequate technological systems, policies and procedures to ensure sensitive consumer information is protected. This will minimize the risk of consumer harm,” ASIC said.

“If an AFS licensee fails to meet its obligations as a result of similar conduct or omissions, ASIC may take enforcement action, as we did with RI Advice, which can result in significant penalties.”

Under the many conditions of an Australia Financial Services (AFS) license, the specific requirements of cybersecurity measures are not mentioned. But, a federal court in the country held an AFS license holder accountable for breaches of its license obligations for failing to adequately manage its cybersecurity risks.

Now, the Australian Securities & Investments Commission (ASIC) has clarified its stance on adequate cybersecurity measures for regulated financial market players. ASIC issues the AFS license and conducts supervisory duties.

“ASIC does not prescribe technical standards nor provide expert guidance on operational aspects of cybersecurity. We also do not prescribe specific requirements for individual license holders,” the regulator stated.

“We do, however, expect licensees to address cyber risk as part of their AFS license obligations, including risk management.”

In addition, it clarified that dual-regulated AFS licensees have the obligation to comply with all necessary standards of the other regulator.

Cybersecurity Measures Are Needed

The questions of cybersecurity measures as a part of the AFS license obligation arose with a ruling against RI Advice by an Australian court. The company was found to have breached its license obligations as it failed to have adequate risk management systems to manage its cybersecurity risks.

The judge acknowledged that it is not possible to reduce the risks of any cyber attack to zero. But, the companies can significantly reduce the risks by implementing appropriate measures.

The Australian Cyber Security Centre (ACSC) already recommended companies implement at least eight essential mitigation strategies to reduce cybersecurity risks, but they are not obligatory.

“This decision confirms that AFS licensees must have adequate technological systems, policies and procedures to ensure sensitive consumer information is protected. This will minimize the risk of consumer harm,” ASIC said.

“If an AFS licensee fails to meet its obligations as a result of similar conduct or omissions, ASIC may take enforcement action, as we did with RI Advice, which can result in significant penalties.”

About the Author: Arnab Shome
Arnab Shome
  • 6528 Articles
  • 87 Followers
About the Author: Arnab Shome
Arnab is an electronics engineer-turned-financial editor. He entered the industry covering the cryptocurrency market for Finance Magnates and later expanded his reach to forex as well. He is passionate about the changing regulatory landscape on financial markets and keenly follows the disruptions in the industry with new-age technologies.
  • 6528 Articles
  • 87 Followers

More from the Author

Retail FX

!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|} !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}